In the early days of Google, Douglas Edwards, one of the company’s first employees, toldAdam Fisher for his book, Valley of Genius, advertising was seen as the devil’s playground. “If you read Larry [Page] and Sergey [Brin]’s original paper . . . where they talked about creating a search engine, they specifically said that advertising was wrong and bad and it would inherently corrupt the search engine if you sold advertising,” he said. Then, of course, Google’s co-founders saw just how lucrative online ads could be. “There was a lot of pressure to generate revenue,” Edwards explained. “And so Larry and Sergey decided that advertising doesn’t have to be evil.” Their change of heart turned out to be lucrative—along with Facebook, Google is now the foremost purveyor of digital ads. In fact, Google actually controls a much larger slice of the pie: nearly 40 percent of the U.S. digital advertising market, including YouTube, Gmail, and other Alphabet properties, compared to Facebook’s almost 20 percent. “Google, in every respect, collects more data [than Facebook],” News Media Alliance president David Chaverntold Bloomberg earlier this year.

This fact has been lost in the churn of recent stories about the way Facebook scrapes people’s personal data to support its advertising business. But with Facebook struggling to placate lawmakers, Brin and Page’s brainchild is almost certainly poised to become the next front in the privacy wars. On Monday, an Associated Press report revealed that though Google purports to offer Android and iPhone owners who use Google apps a way to curtail the amount of data they share with the tech giant, that toggle is by no means airtight. You can pause a setting called “Location History,” meaning that your location data as collected by apps like Google Maps will no longer be stored. (Sharing the data creates a virtual map of all the places you’ve traveled with your phone.) However, myriad Google apps reportedly store precise time-stamped location data about you automatically, without asking permission. From the A.P.:

For example, Google stores a snapshot of where you are when you merely open its Maps app. Automatic daily weather updates on Android phones pinpoint roughly where you are. And some searches that have nothing to do with location, like “chocolate chip cookies,” or “kids science kits,” pinpoint your precise latitude and longitude—accurate to the square foot—and save it to your Google account.

Google maintains that this is all above-board. “There are a number of different ways that Google may use location to improve people’s experience, including: Location History, Web and App Activity, and through device-level Location Services,” a Google spokesperson told the A.P. in a statement. “We provide clear descriptions of these tools, and robust controls so people can turn them on or off, and delete their histories at any time.” Google is correct, in that pausing the location history on a device prevents your activity from being stored to your account. But if a user only pauses “Location History,” Google can still collect other location markers, which must be painstakingly deleted by hand.

There’s no question that Google’s scraping of location data is a boon to its advertising business. In 2014, the company introduced a feature to let advertisers track the efficacy of online ads at driving foot traffic to brick-and-mortar stores, which relies on user-location data. And at a Google Marketing Live Summit last month, the company introduced a “local campaigns” tool that uses ads to boost the number of visits stores get from customers—another tool that relies on data from peoples’ location histories. These and other tools have catapulted Google to the forefront of the online advertising businesses; though spending on online ads reportedly rose to some $88 billion last year, more than 90 percent of that growth went to either Google or Facebook, per The New York Times.

As Facebook flounders in the public view, shedding North American and European users, frightening Wall Street, and struggling with existential questions about content moderation—a dilemma Mark Zuckerberg made twice as awkward with a poorly timed Holocaust gaffe—Google’s role in the daily lives of Americans has increased. Thanks in part to its wide variety of products, such as YouTube and Waze, in June Google accounted for 34.2 percent of all time on digital media. Even as more and more people become reliant on its tools, Google is coming up with ways to spread its influence into new spheres: ways like using its predictive technology—which it already incorporates in products like Search, Gmail, and Google Photos—in tandem with machine learning to predict the likelihood that someone who’s been hospitalized will die.

Google’s expansion into areas like the medical field has already raised red flags. “Companies like Google . . . are going to have a unique, almost monopolistic, ability to capitalize on all the data we generate,” Andrew Burt, chief privacy officer for data company Immuta, told Bloomberg in June. But where the death-prediction business is murky, Google’s circumvention of the “Location History” off switch is easier to digest—and easier to regulate. Given the vast amounts of data it collects about users, it seems clear that Google is poised to draw some of the constant fire that Facebook has attracted from Washington. A rough blueprint to curb Google already exists—last month, European regulators handed the company a record-breaking $5 billion anti-trust fine, though it’s unclear whether the penalty will have a substantial impact (a week after receiving the fine, Google posted its fastest revenue growth in four years, and a 25.4 percent increase in its net revenue year over year). If Congress needs a fresh target, Google is a sitting duck.